The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses local configuration files containing authentication secrets.
Multiple scripts including eval-quality.ts, evolve-prompt.ts, run-eval.ts, and generate.ts read and parse the ~/.claude/.env file to retrieve the ANTHROPIC_API_KEY for network authentication.
[DATA_EXFILTRATION]: Private project data and session transcripts are sent to a third-party LLM provider.
The extract-candidates.ts script reads raw session transcripts from ~/.claude/projects/, which contain real code and project data.
This sensitive content is interpolated into prompts and transmitted to the Anthropic API for title generation and evaluation.
[COMMAND_EXECUTION]: Shell commands are executed using unvalidated input from an external source.
In scripts/generate-core.ts, the getProjectName function executes git config using a cwd variable in a shell template.
The cwd value is passed via Bun.stdin in scripts/generate.ts, creating a command injection vector if the input source is controlled by an attacker.
[PROMPT_INJECTION]: The skill processes untrusted session data within LLM prompts, making it susceptible to indirect prompt injection.
Ingestion points: Session transcripts are read from ~/.claude/projects/ and parsed in scripts/generate-core.ts.
Boundary markers: User messages are included in prompts via basic string interpolation with quotes (e.g., User's request: "${request}"), which fails to provide a secure boundary against instruction overrides.
Capability inventory: The skill possesses the capability to read and write local files and perform network operations via the Anthropic SDK.
Sanitization: The extractUserText function provides minimal filtering for system tags but does not protect against adversarial instructions embedded in the processed transcript text.

session-titles